@mcp-index/sdk 0.1.0

package/dist/src/wrap.js

@@ -0,0 +1,554 @@
+/**
+ * Pre-flight drift INTERCEPTOR — the TypeScript SDK-wrapper surface, at parity
+ * with Python `tooling/cse/preflight_intercept.py`.
+ *
+ * `wrap(session)` returns a transparent JS `Proxy` over the real
+ * `@modelcontextprotocol/sdk` `Client`: every method/prop passes through the
+ * get-trap UNTOUCHED, EXCEPT the three gated seams:
+ *   - `listTools`  — TOFU-pin every observed tool's PUBLIC contract.
+ *   - `callTool`   — run the shared Gate before delegating; HOLD on drift.
+ *   - `request`    — the low-level RPC chokepoint (the TS analog of Python's
+ *     `send_request`). `callTool` is sugar over `request({method:'tools/call'})`,
+ *     so a caller can invoke any tool straight through `request`; we gate a
+ *     `tools/call` there too, or the pre-flight check is a paper wall.
+ *   - `requestStream` — the EXPERIMENTAL streaming chokepoint. The SDK's task
+ *     surface (`client.experimental.tasks.callToolStream`) invokes a tool via
+ *     `requestStream({method:'tools/call'})`, a SECOND RPC path that does NOT go
+ *     through `request`. `requestStream` is also reachable directly on the
+ *     session. We gate a `tools/call` on BOTH the session-level `requestStream`
+ *     AND a wrapped `experimental` accessor (whose `tasks.callToolStream` /
+ *     `tasks.requestStream` desugar to it), or the streaming surface is a hole
+ *     in the wall. The gate runs PRE-FLIGHT: a HELD verdict yields a throwing
+ *     async generator that NEVER touches the upstream stream (fail-closed).
+ *
+ * NO CREDENTIAL (structural): the wrapper holds NO token, NO auth, opens NO
+ * connection. It reuses the wrapped session's own authenticated transport. The
+ * shared Gate reads only the PUBLIC contract.
+ */
+import { Gate, HELD_PROVENANCE_UNAVAILABLE_BANNER, INTERNAL_ERROR_HELD_MESSAGE, isInternalErrorVerdict, renderHoldBanner, behaviourObserved, } from "./gate.js";
+import { Decision, utcNowIso } from "./preflight.js";
+import { ChangeKind } from "./schemaDiff.js";
+import { Operation } from "./errors.js";
+import { Action } from "./outcomes.js";
+import { surfaceProvenance } from "./provenance.js";
+const DEFAULT_BEHAVIORAL_MANDATED_KINDS = new Set([
+    ChangeKind.OUTPUT_SCHEMA_CHANGED,
+    ChangeKind.ANNOTATION_FLIP_TO_DESTRUCTIVE,
+]);
+/** A HOLD raised before delegating to the wrapped session. Carries the structured
+ * verdict + (when a complete provenance backs the finding) the provenance. Honest
+ * voice: a HOLD is a CONTRACT DIFF, not a safety verdict. */
+export class PreflightHold extends Error {
+    verdict;
+    provenance;
+    constructor(verdict, provenance, message) {
+        super(message);
+        this.name = "PreflightHold";
+        this.verdict = verdict;
+        this.provenance = provenance;
+    }
+}
+// Raw transport seams we REFUSE to delegate (defense-in-depth) — so a caller
+// cannot hand-assemble a tools/call frame straight to the socket, bypassing the
+// gated `callTool` / `request` / `requestStream` chokepoints. Mirrors the Python
+// `_DENY_DELEGATION` set, but adapted to the TS SDK's ACTUAL seams.
+//
+// CRITICAL (audit H1): the TS SDK `Protocol` base exposes a PUBLIC `get transport()`
+// returning the live `Transport`, whose `.send(message)` accepts ANY JSONRPCMessage.
+// Left delegated, a caller could do `wrapped.transport.send({...tools/call...})` and
+// invoke a DRIFTED tool straight to the socket — a real bypass of the STATED defense
+// in this file's docstring. So `transport` MUST be denied through the wrapper (returns
+// undefined). This is SAFE: transport lifecycle (connect/close) is owned by whoever
+// created the session — `Protocol.connect()` takes the transport as an ARGUMENT and
+// writes the private `_transport`; `close()` reads `_transport` directly — neither
+// reaches the wrapper's `transport` accessor. No legitimate tool-operation path in the
+// integration tests or the documented public API needs `wrapped.transport`.
+//
+// `_transport` is denied for the same reason; `send` is denied defensively in case a
+// future SDK surfaces a raw send on the session itself (no public `send` exists on the
+// Protocol/Client today — it lives only on the `Transport` reached via `transport`).
+// The Python SDK names (`_read_stream`/`_write_stream`/anyio readers) do NOT exist on
+// the TS SDK — they were vestigial copies and are DROPPED (audit L1: keep the list
+// honest, only real seams).
+const DENY_DELEGATION = new Set([
+    "transport",
+    "_transport",
+    "send",
+]);
+/** Pull PUBLIC tool definitions out of whatever `listTools()` returned. Tolerant
+ * (the listing is attacker-derived): a `{tools: [...]}` object, a bare list, each
+ * entry a dict or an SDK Tool object. Normalizes to the PUBLIC-contract dict. */
+function toolsFromResult(result) {
+    let raw;
+    if (result !== null && typeof result === "object" && !Array.isArray(result)) {
+        raw = result["tools"];
+    }
+    else {
+        raw = result;
+    }
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw) {
+        const defn = toolToDict(entry);
+        if (defn !== null)
+            out.push(defn);
+    }
+    return out;
+}
+function attrOrKey(entry, key) {
+    if (entry !== null && typeof entry === "object") {
+        return entry[key];
+    }
+    return undefined;
+}
+function toolToDict(entry) {
+    const name = attrOrKey(entry, "name");
+    if (typeof name !== "string" || !name)
+        return null;
+    const desc = attrOrKey(entry, "description");
+    const schema = attrOrKey(entry, "inputSchema");
+    const inSch = schema !== null && typeof schema === "object" && !Array.isArray(schema) ? schema : {};
+    const record = {
+        name,
+        description: desc !== undefined && desc !== null ? String(desc) : "",
+        inputSchema: inSch,
+    };
+    const ann = attrOrKey(entry, "annotations");
+    if (ann !== null && typeof ann === "object" && !Array.isArray(ann))
+        record["annotations"] = ann;
+    const outp = attrOrKey(entry, "outputSchema");
+    if (outp !== null && typeof outp === "object" && !Array.isArray(outp))
+        record["outputSchema"] = outp;
+    return record;
+}
+/** DUCK-TYPE a `request` argument -> (method, toolName). The TS SDK passes a
+ * `{method, params}` request object. FAIL-CLOSED: a `tools/call` whose name
+ * cannot be read runs under "" -> the no-pin path fail-closes. */
+function requestMethodAndTool(request) {
+    try {
+        const root = request;
+        const method = root?.["method"];
+        const methodStr = typeof method === "string" ? method : null;
+        if (methodStr !== "tools/call")
+            return [methodStr, ""];
+        const params = root["params"];
+        const name = params?.["name"];
+        return ["tools/call", typeof name === "string" ? name : ""];
+    }
+    catch {
+        return ["tools/call", ""];
+    }
+}
+function isThenable(v) {
+    return v !== null && typeof v === "object" && typeof v.then === "function";
+}
+/** The intercepting core. Holds the shared Gate + the last-observed PUBLIC
+ * contracts (so the Gate re-derives the live hash with no second round-trip) +
+ * the optional on-device stores. NO token, NO transport. */
+class Interceptor {
+    session;
+    gate;
+    onHold;
+    autoValidateBehavior;
+    stats;
+    outcomes;
+    observed = new Map();
+    lastSurface = new Map();
+    // The tier the LAST gated call for a tool ACTUALLY reached, for its provenance (mirrors the
+    // Python wrapper's `_last_tier_reached`). AUDIT-LOW FLOOR FIX: tier_reached reflects what
+    // RAN — an INCONCLUSIVE only OFFERED a behavioral check floors to 0 (→ STRUCTURAL_ONLY),
+    // never a false BEHAVIORAL/3 stamp; 3 only when a behavioral verifier actually ran.
+    lastTierReached = new Map();
+    constructor(session, opts) {
+        this.session = session;
+        this.gate = new Gate({
+            pin: opts.pin,
+            serverId: opts.serverId,
+            failOpen: opts.failOpen,
+            autoAcceptBenign: opts.autoAcceptBenign,
+            now: opts.now ?? utcNowIso,
+            ownership: opts.ownership,
+            behavioralMandatedKinds: opts.behavioralMandatedKinds ?? DEFAULT_BEHAVIORAL_MANDATED_KINDS,
+            verifier: opts.verifier ?? null,
+            posture: opts.posture,
+            errors: opts.errors ?? null,
+        });
+        this.onHold = opts.onHold ?? null;
+        this.autoValidateBehavior = opts.autoValidateBehavior ?? false;
+        this.stats = opts.stats ?? null;
+        this.outcomes = opts.outcomes ?? null;
+    }
+    // ------------------------------------------------------------- list_tools
+    listTools(target, args) {
+        const result = target.listTools.apply(target, args);
+        if (isThenable(result)) {
+            return result.then((r) => {
+                this.observe(r);
+                return r;
+            });
+        }
+        this.observe(result);
+        return result;
+    }
+    observe(result) {
+        try {
+            const tools = toolsFromResult(result);
+            for (const defn of tools) {
+                const name = defn["name"];
+                this.observed.set(name, defn);
+                this.gate.observe(name, defn);
+            }
+        }
+        catch (exc) {
+            this.gate.captureError(exc, Operation.LIST_TOOLS, "wrap.observe");
+        }
+    }
+    // -------------------------------------------------------------- call_tool
+    callTool(target, args) {
+        // SDK: callTool(params, resultSchema?, options?), params = {name, arguments}.
+        const params = (args[0] ?? {});
+        const name = typeof params["name"] === "string" ? params["name"] : "";
+        const verdict = this.decideOrInternalHold(name, Operation.CALL_TOOL);
+        if (verdict.decision === Decision.PROCEED) {
+            if (verdict.failOpenWarning)
+                warn(verdict);
+            return target.callTool.apply(target, args);
+        }
+        return this.refuseAsync(name, verdict);
+    }
+    // ------------------------------------------------------------ request
+    request(target, args) {
+        const reqFn = target.request;
+        if (typeof reqFn !== "function") {
+            throw new TypeError("wrapped session has no request() method");
+        }
+        const [method, toolName] = requestMethodAndTool(args[0]);
+        if (method !== "tools/call") {
+            return reqFn.apply(target, args);
+        }
+        const verdict = this.decideOrInternalHold(toolName, Operation.SEND_REQUEST);
+        if (verdict.decision === Decision.PROCEED) {
+            if (verdict.failOpenWarning)
+                warn(verdict);
+            return reqFn.apply(target, args);
+        }
+        // The SDK `request()` is async (returns a Promise<SchemaOutput>), so — like
+        // `callTool` — a HOLD must surface as a REJECTED Promise, not a sync throw,
+        // or the wrapper is not a transparent drop-in (a caller's `await`/`.catch`
+        // would miss the hold). Refusal goes through the SAME `refuseAsync` as
+        // `callTool` (one shared block, mirroring Python's shared refusal): same
+        // onHold dispatch, same provenance/banner, same PreflightHold; the wrapped
+        // session is NEVER touched on this path.
+        return this.refuseAsync(toolName, verdict);
+    }
+    // ------------------------------------------------------- requestStream
+    /** Gate the EXPERIMENTAL streaming RPC chokepoint. `requestStream` takes the
+     * same `{method, params}` request shape as `request`, so we parse + gate a
+     * `tools/call` identically. The SDK signature returns an AsyncGenerator, so
+     * the gate must surface PRE-FLIGHT: a HELD verdict returns a generator that
+     * THROWS on first iteration WITHOUT ever delegating to the upstream stream
+     * (the real `requestStream` is never called -> upstream touched 0 times,
+     * fail-closed). A non-`tools/call` (or PROCEED) delegates the real generator
+     * untouched. `streamFn` is the upstream `requestStream` bound to the right
+     * receiver (the raw session for the session-level seam; the SDK's own
+     * `_client` for the experimental seam, which it captured itself). */
+    requestStream(streamFn, receiver, args) {
+        const [method, toolName] = requestMethodAndTool(args[0]);
+        if (method !== "tools/call") {
+            return streamFn.apply(receiver, args);
+        }
+        const verdict = this.decideOrInternalHold(toolName, Operation.SEND_REQUEST);
+        if (verdict.decision === Decision.PROCEED) {
+            if (verdict.failOpenWarning)
+                warn(verdict);
+            return streamFn.apply(receiver, args);
+        }
+        return this.refuseStream(toolName, verdict);
+    }
+    /** A HELD streaming seam: an async generator that raises the SAME
+     * `PreflightHold` (or onHold result) as `refuseAsync`, on first iteration,
+     * before the upstream stream is ever opened. Shares `heldSurface` / `onHold`
+     * with the async refusal block so streaming and non-streaming holds are
+     * byte-for-byte identical (same provenance, banner, PreflightHold). */
+    async *refuseStream(name, verdict) {
+        if (this.onHold !== null) {
+            yield await Promise.resolve(this.onHold(verdict));
+            return;
+        }
+        const [prov, banner] = this.heldSurface(name, verdict);
+        throw new PreflightHold(verdict, prov, banner);
+    }
+    /** Build a gated mirror of the SDK's `experimental` accessor. The SDK's
+     * `experimental.tasks` holds the UNWRAPPED client, so its `callToolStream` /
+     * `requestStream` bypass the proxy and hit `_client.requestStream` directly.
+     * We re-route BOTH tool-invoking stream surfaces through `this.requestStream`
+     * (the same gate as the session-level seam) by calling the SDK's own methods
+     * — preserving their task-augmentation / output-schema-validation behaviour —
+     * but only AFTER a PROCEED verdict; a HELD verdict throws before any upstream
+     * stream is opened. Every non-stream member of `tasks` (getTask, listTasks,
+     * cancelTask, …) and the rest of `experimental` delegate UNTOUCHED. */
+    wrapExperimental(real) {
+        const self = this;
+        const realTasks = real.tasks;
+        const tasksProxy = new Proxy(realTasks, {
+            get(t, prop, _recv) {
+                if (prop === "callToolStream") {
+                    // callToolStream(params, resultSchema?, options?) desugars to
+                    // requestStream({method:'tools/call', params}, ...). Gate on params.name
+                    // PRE-FLIGHT; only on PROCEED do we invoke the SDK's real
+                    // callToolStream (so its task/output-schema logic is preserved).
+                    return (...a) => {
+                        const params = (a[0] ?? {});
+                        const toolName = typeof params["name"] === "string" ? params["name"] : "";
+                        const verdict = self.decideOrInternalHold(toolName, Operation.SEND_REQUEST);
+                        if (verdict.decision === Decision.PROCEED) {
+                            if (verdict.failOpenWarning)
+                                warn(verdict);
+                            return realTasks.callToolStream.apply(realTasks, a);
+                        }
+                        return self.refuseStream(toolName, verdict);
+                    };
+                }
+                if (prop === "requestStream") {
+                    // tasks.requestStream(request, ...) takes the raw {method,params} shape —
+                    // route it through the SAME gate as the session-level seam, delegating
+                    // the real method (bound to realTasks) on PROCEED.
+                    return (...a) => self.requestStream(realTasks.requestStream, realTasks, a);
+                }
+                const v = Reflect.get(t, prop, t);
+                return typeof v === "function" ? v.bind(t) : v;
+            },
+        });
+        return new Proxy(real, {
+            get(t, prop, _recv) {
+                if (prop === "tasks")
+                    return tasksProxy;
+                const v = Reflect.get(t, prop, t);
+                return typeof v === "function" ? v.bind(t) : v;
+            },
+        });
+    }
+    /** The SINGLE refusal path for BOTH gated async seams (`callTool` and the
+     * low-level `request` chokepoint) — the TS analog of the one refusal block
+     * Python's `call_tool` / `send_request` share. Both SDK seams return a Promise,
+     * so a HOLD surfaces as a REJECTED Promise (never a sync throw), so the wrapper
+     * stays a transparent drop-in: a caller's `await` / `.catch` sees the hold. The
+     * wrapped session is NEVER touched on this path (fail-closed). When an `onHold`
+     * callback is set we return its result resolved to a Promise, so a caller that
+     * suppresses the throw still gets a thenable like the upstream would yield. */
+    refuseAsync(name, verdict) {
+        if (this.onHold !== null)
+            return Promise.resolve(this.onHold(verdict));
+        const [prov, banner] = this.heldSurface(name, verdict);
+        return Promise.reject(new PreflightHold(verdict, prov, banner));
+    }
+    decideOrInternalHold(name, operation) {
+        try {
+            let stat = this.gate.evaluate(name, this.observed.get(name) ?? null);
+            stat = this.maybeAutoValidate(name, stat);
+            const verdict = this.gate.applyPosture(stat);
+            this.recordCall(name, stat, verdict);
+            return verdict;
+        }
+        catch (exc) {
+            this.gate.captureError(exc, operation, "wrap.decideOrInternalHold");
+            return this.gate.internalErrorVerdict(name);
+        }
+    }
+    maybeAutoValidate(name, stat) {
+        if (stat.decision === Decision.INCONCLUSIVE && this.autoValidateBehavior && this.gate.verifier !== null) {
+            const [resolved, outcome] = this.gate.runBehavioralOutcome(name, this.observed.get(name) ?? null, stat, this.gate.verifier);
+            // Behaviour ACTUALLY ran. Record tier 3 ONLY for an OBSERVED result — CLEARED or FAILED.
+            // UNAVAILABLE / DECLINED / never-consulted observed nothing → floor to 0. The tier is
+            // keyed on the STRUCTURED outcome enum, NEVER on the verifier-controlled reason string (a
+            // substring check there would let an UNAVAILABLE whose reason contains "behavioral
+            // validation FAILED" forge a tier-3 stamp on evidence that never ran).
+            this.lastTierReached.set(name, behaviourObserved(outcome) ? 3 : 0);
+            return resolved;
+        }
+        // INCONCLUSIVE only OFFERED a behavioral check (no auto-validate / no verifier) → nothing
+        // ran → floor to 0 (the audit-LOW floor fix). Any other static verdict is tier 0 too.
+        this.lastTierReached.set(name, 0);
+        return stat;
+    }
+    // ------------------------------------------------------------- stats record
+    recordCall(name, stat, effective) {
+        if (this.stats !== null) {
+            if (effective.decision === Decision.HOLD || effective.decision === Decision.INCONCLUSIVE) {
+                this.stats.recordHold();
+            }
+        }
+        this.captureOutcome(name, stat, effective);
+    }
+    captureOutcome(name, stat, effective) {
+        if (this.outcomes === null)
+            return;
+        if (isInternalErrorVerdict(effective) || isInternalErrorVerdict(stat))
+            return;
+        if (effective.decision === Decision.HOLD || effective.decision === Decision.INCONCLUSIVE) {
+            const prov = this.provenanceFor(name, effective);
+            if (prov === null)
+                return;
+            this.lastSurface.set(name, this.outcomes.recordSurface(prov, this.gate.posture));
+        }
+        else if (effective.decision === Decision.PROCEED &&
+            (stat.decision === Decision.HOLD || stat.decision === Decision.INCONCLUSIVE) &&
+            stat.drift.length > 0) {
+            const prov = this.provenanceFor(name, stat);
+            if (prov === null)
+                return;
+            const sid = this.outcomes.recordSurface(prov, this.gate.posture);
+            this.lastSurface.set(name, sid);
+            this.outcomes.recordResponse(sid, Action.OVERRIDE);
+        }
+    }
+    provenanceFor(name, verdict) {
+        const pinned = this.gate.pinFor(name);
+        return surfaceProvenance(verdict, {
+            serverId: this.gate.serverId,
+            tool: name,
+            oldSchema: pinned !== null ? pinned.schema : null,
+            newSchema: this.observed.get(name) ?? null,
+            tierReached: this.lastTierReached.get(name) ?? 0,
+            source: "wrapper",
+        });
+    }
+    heldSurface(name, verdict) {
+        if (isInternalErrorVerdict(verdict))
+            return [null, INTERNAL_ERROR_HELD_MESSAGE];
+        const prov = this.provenanceFor(name, verdict);
+        if (prov === null)
+            return [null, HELD_PROVENANCE_UNAVAILABLE_BANNER];
+        const tally = this.stats !== null ? this.stats.holdsThisMonth() : null;
+        return [prov, renderHoldBanner(verdict, tally)];
+    }
+    holdBanner(verdict) {
+        const [, banner] = this.heldSurface(verdict.toolName, verdict);
+        return banner;
+    }
+    // ----------------------------------------------------- behavioral validation
+    validateBehaviorNow(toolName, verifier) {
+        const observed = this.observed.get(toolName) ?? null;
+        const verdict = this.gate.evaluate(toolName, observed);
+        if (verdict.decision === Decision.PROCEED)
+            return verdict;
+        const chosen = verifier ?? this.gate.verifier;
+        if (chosen === null || chosen === undefined)
+            return verdict;
+        this.recordOutcomeResponse(toolName, Action.ESCALATE);
+        const [resolved, outcome] = this.gate.runBehavioralOutcome(toolName, observed, verdict, chosen);
+        // Behaviour ACTUALLY ran on demand (the third door) — record tier 3 ONLY for an OBSERVED
+        // result (CLEARED or FAILED). UNAVAILABLE / DECLINED / never-consulted floor to 0. Keyed on
+        // the STRUCTURED outcome enum, NEVER on the verifier-controlled reason string (mirrors the
+        // Python wrapper).
+        if (behaviourObserved(outcome)) {
+            this.lastTierReached.set(toolName, 3);
+        }
+        return resolved;
+    }
+    // ------------------------------------------------------------------- repin
+    repin(tool) {
+        const written = [];
+        const names = tool !== undefined ? [tool] : [...this.observed.keys()].sort();
+        for (const name of names) {
+            const observed = this.observed.get(name);
+            if (observed === undefined)
+                continue;
+            written.push(this.gate.repinOne(name, observed));
+            if (this.stats !== null)
+                this.stats.recordRepin();
+            this.recordOutcomeResponse(name, Action.REPIN);
+        }
+        return written;
+    }
+    recordOutcomeResponse(name, action) {
+        if (this.outcomes === null)
+            return;
+        const sid = this.lastSurface.get(name);
+        if (sid === undefined)
+            return;
+        this.outcomes.recordResponse(sid, action);
+    }
+}
+function warn(verdict) {
+    process.stderr.write(`preflight WARNING fail-open: PROCEED on un-checkable tool ` +
+        `${verdict.serverId}/${verdict.toolName} — ${verdict.reason}\n`);
+}
+// The wrapper's OWN management methods — names that shadow delegation.
+const OWN_METHODS = new Set(["repin", "validateBehaviorNow", "holdBanner", "__interceptor__"]);
+export function wrap(session, opts) {
+    const sess = session;
+    const interceptor = new Interceptor(sess, opts);
+    const handler = {
+        get(target, prop, _receiver) {
+            if (typeof prop !== "string") {
+                return Reflect.get(target, prop, target);
+            }
+            if (prop === "__interceptor__")
+                return interceptor;
+            if (prop === "listTools") {
+                return (...args) => interceptor.listTools(target, args);
+            }
+            if (prop === "callTool") {
+                return (...args) => interceptor.callTool(target, args);
+            }
+            if (prop === "request") {
+                return (...args) => interceptor.request(target, args);
+            }
+            if (prop === "requestStream") {
+                // The experimental streaming RPC chokepoint, reachable directly on the
+                // session. Gate a tools/call here too (parity with `request`), binding
+                // the real upstream `requestStream` to the raw target.
+                return (...args) => {
+                    const fn = Reflect.get(target, "requestStream", target);
+                    if (typeof fn !== "function") {
+                        throw new TypeError("wrapped session has no requestStream() method");
+                    }
+                    return interceptor.requestStream(fn, target, args);
+                };
+            }
+            if (prop === "experimental") {
+                // The SDK `experimental` accessor returns an object whose `tasks` holds
+                // the UNWRAPPED client; left untouched it bypasses the gate. Return a
+                // gated mirror so `tasks.callToolStream` / `tasks.requestStream` run
+                // through the SAME gate as the session seams.
+                const real = Reflect.get(target, "experimental", target);
+                if (real === null || typeof real !== "object")
+                    return real;
+                return interceptor.wrapExperimental(real);
+            }
+            if (prop === "repin") {
+                return (tool) => interceptor.repin(tool);
+            }
+            if (prop === "validateBehaviorNow") {
+                return (toolName, verifier) => interceptor.validateBehaviorNow(toolName, verifier);
+            }
+            if (prop === "holdBanner") {
+                return (verdict) => interceptor.holdBanner(verdict);
+            }
+            if (DENY_DELEGATION.has(prop)) {
+                // Defense-in-depth: refuse to delegate the raw transport seams.
+                return undefined;
+            }
+            // Delegate everything else UNTOUCHED. Bind methods to the real target so
+            // `this` inside the SDK points at the real session, never the proxy.
+            const value = Reflect.get(target, prop, target);
+            if (typeof value === "function") {
+                return value.bind(target);
+            }
+            return value;
+        },
+        has(target, prop) {
+            if (typeof prop === "string" && OWN_METHODS.has(prop))
+                return true;
+            return Reflect.has(target, prop);
+        },
+    };
+    return new Proxy(sess, handler);
+}
+/** Module-level convenience: re-pin observed contracts on a wrapped session. */
+export function repin(wrapped, tool) {
+    return wrapped.repin(tool);
+}
+//# sourceMappingURL=wrap.js.map

package/dist/src/wrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../src/wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,IAAI,EAGJ,kCAAkC,EAClC,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,QAAQ,EAAgB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAA4B,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,MAAM,iCAAiC,GAA4B,IAAI,GAAG,CAAC;IACzE,UAAU,CAAC,qBAAqB;IAChC,UAAU,CAAC,8BAA8B;CAC1C,CAAC,CAAC;AAEH;;6DAE6D;AAC7D,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,OAAO,CAAmB;IAC1B,UAAU,CAAoB;IAEvC,YAAY,OAAyB,EAAE,UAA6B,EAAE,OAAe;QACnF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAmBD,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,oEAAoE;AACpE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,qFAAqF;AACrF,qFAAqF;AACrF,uFAAuF;AACvF,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,uFAAuF;AACvF,4EAA4E;AAC5E,EAAE;AACF,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,sFAAsF;AACtF,mFAAmF;AACnF,4BAA4B;AAC5B,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,WAAW;IACX,YAAY;IACZ,MAAM;CACP,CAAC,CAAC;AA0BH;;iFAEiF;AACjF,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,GAAY,CAAC;IACjB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,GAAG,GAAI,MAAkC,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,GAAW;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAQ,KAAiC,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,MAAM,GAAY;QACtB,IAAI;QACJ,WAAW,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;IAChG,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IACrG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;kEAEkE;AAClE,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAkC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,IAAI,SAAS,KAAK,YAAY;YAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAwC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,UAAU,CAAC;AACrG,CAAC;AAED;;4DAE4D;AAC5D,MAAM,WAAW;IAeJ;IAdM,IAAI,CAAO;IACX,MAAM,CAAkD;IACxD,oBAAoB,CAAU;IAC9B,KAAK,CAAoB;IACzB,QAAQ,CAAsB;IAC9B,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzD,4FAA4F;IAC5F,0FAA0F;IAC1F,yFAAyF;IACzF,oFAAoF;IACnE,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D,YACW,OAAoB,EAC7B,IAAiB;QADR,YAAO,GAAP,OAAO,CAAa;QAG7B,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,IAAI,iCAAiC;YAC1F,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxC,CAAC;IAED,2EAA2E;IAC3E,SAAS,CAAC,MAAmB,EAAE,IAAe;QAC5C,MAAM,MAAM,GAAI,MAAM,CAAC,SAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,MAAe;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAW,CAAC;gBACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,MAAmB,EAAE,IAAe;QAC3C,8EAA8E;QAC9E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,eAAe;gBAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAQ,MAAM,CAAC,QAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,uEAAuE;IACvE,OAAO,CAAC,MAAmB,EAAE,IAAe;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,OAAQ,KAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,eAAe;gBAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAQ,KAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,yCAAyC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,wEAAwE;IACxE;;;;;;;;;yEASqE;IACrE,aAAa,CAAC,QAAe,EAAE,QAAiB,EAAE,IAAe;QAC/D,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAA4B,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,eAAe;gBAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAA4B,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;2EAIuE;IAC/D,KAAK,CAAC,CAAC,YAAY,CAAC,IAAY,EAAE,OAAyB;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;2EAQuE;IACvE,gBAAgB,CAAC,IAAsB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE;YACtC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK;gBAChB,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAC9B,8DAA8D;oBAC9D,yEAAyE;oBACzE,0DAA0D;oBAC1D,iEAAiE;oBACjE,OAAO,CAAC,GAAG,CAAY,EAA2B,EAAE;wBAClD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;wBACvD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;wBAC5E,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;4BAC1C,IAAI,OAAO,CAAC,eAAe;gCAAE,IAAI,CAAC,OAAO,CAAC,CAAC;4BAC3C,OAAQ,SAAS,CAAC,cAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAA4B,CAAC;wBAC5F,CAAC;wBACD,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAC9C,CAAC,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;oBAC7B,0EAA0E;oBAC1E,uEAAuE;oBACvE,mDAAmD;oBACnD,OAAO,CAAC,GAAG,CAAY,EAA2B,EAAE,CAClD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,aAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAE,CAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;YACrB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK;gBAChB,IAAI,IAAI,KAAK,OAAO;oBAAE,OAAO,UAAU,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAE,CAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;SACF,CAAqB,CAAC;IACzB,CAAC;IAED;;;;;;;mFAO+E;IACvE,WAAW,CAAC,IAAY,EAAE,OAAyB;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAEO,oBAAoB,CAAC,IAAY,EAAE,SAAoB;QAC7D,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACrE,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,IAAY,EAAE,IAAsB;QAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,CACxD,IAAI,EACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAC/B,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,QAAQ,CACnB,CAAC;YACF,yFAAyF;YACzF,sFAAsF;YACtF,0FAA0F;YAC1F,mFAAmF;YACnF,uEAAuE;YACvE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,0FAA0F;QAC1F,sFAAsF;QACtF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IACrE,UAAU,CAAC,IAAY,EAAE,IAAsB,EAAE,SAA2B;QAClF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACzF,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAEO,cAAc,CAAC,IAAY,EAAE,IAAsB,EAAE,SAA2B;QACtF,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QACnC,IAAI,sBAAsB,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9E,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YACzF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACjD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO;YAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACnF,CAAC;aAAM,IACL,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO;YACvC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAY,EAAE,OAAyB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,iBAAiB,CAAC,OAAO,EAAE;YAChC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YACjD,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;YAC1C,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAChD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,IAAY,EAAE,OAAyB;QACzD,IAAI,sBAAsB,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,UAAU,CAAC,OAAyB;QAClC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,QAAgB,EAAE,QAA6B;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC5D,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChG,yFAAyF;QACzF,4FAA4F;QAC5F,2FAA2F;QAC3F,mBAAmB;QACnB,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,IAAa;QACjB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,qBAAqB,CAAC,IAAY,EAAE,MAAc;QACxD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,IAAI,CAAC,OAAyB;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4DAA4D;QAC1D,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,MAAM,IAAI,CAClE,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAiB/F,MAAM,UAAU,IAAI,CAAmB,OAAU,EAAE,IAAiB;IAClE,MAAM,IAAI,GAAG,OAAiC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhD,MAAM,OAAO,GAA8B;QACzC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,WAAW,CAAC;YACnD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,IAAe,EAAW,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,IAAe,EAAW,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,IAAe,EAAW,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC7B,uEAAuE;gBACvE,uEAAuE;gBACvE,uDAAuD;gBACvD,OAAO,CAAC,GAAG,IAAe,EAA2B,EAAE;oBACrD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;oBACxD,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;wBAC7B,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,WAAW,CAAC,aAAa,CAAC,EAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC9D,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,8CAA8C;gBAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;gBACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC3D,OAAO,WAAW,CAAC,gBAAgB,CAAC,IAAwB,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAa,EAAgB,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACnC,OAAO,CAAC,QAAgB,EAAE,QAA6B,EAAoB,EAAE,CAC3E,WAAW,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,OAAO,CAAC,OAAyB,EAAU,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,gEAAgE;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAQ,KAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,OAAO,CAA0B,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,KAAK,CAAmB,OAAmB,EAAE,IAAa;IACxE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@mcp-index/sdk",
+  "version": "0.1.0",
+  "description": "Pre-flight MCP tool-contract drift interceptor — one-line wrap() over an MCP client session that HOLDs a tool call before your agent runs it when the contract drifted from your pin. No credential handling.",
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "author": "Bhartis LLC",
+  "homepage": "https://mcpindex.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mcpindex-ai/mcpindex-trust.git",
+    "directory": "clients/ts"
+  },
+  "type": "module",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
+    }
+  },
+  "files": ["dist/src", "README.md", "LICENSE"],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "tsc -p tsconfig.json && node --test \"dist/test/**/*.test.js\"",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": ["mcp", "model-context-protocol", "drift", "security", "tofu", "agent"],
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": ">=1.0.0"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@types/node": "^25.9.1",
+    "typescript": "^6.0.3"
+  }
+}